Files
computer-playbook/tests/unit/python/roles/test-e2e-playwright/test_timeouts_helper.py
T
kevinveenbirkenbachandClaude Opus 5 677a63931c Merge branch 'feature/network/multi-network-serving' into feature/store-i18n
Resolves 68 conflicted files. The governing rule was our structure with their
network semantics: the tor boolean becomes a network mode (clearnet | tor |
multi) throughout the variant layer, while this branch's architecture and mesh
axes, its extracted modules and its i18n content stay.

Where the two sides covered different ground, both are kept rather than one
picked:

- ca_injected answers a ca_client on the deployment's TLS mode OR on an SSO
  issuer that resolves self-signed. 3a3e9ed2c9 records why: an issuer is not
  an object store, so keeping only one side drops the other's coverage.
- get_merged_domains keeps the loud refusal when svc-net-tor is deployed
  without a provisioned node, now gated on their tor_serves_host; their
  node_onion_of returns an empty string there, which would have served every
  onion-exclusive app on clearnet in silence.
- sso_cookie_domains stays the single source for oauth2-proxy's cookie scope.
  Their per-network branch omitted the issuer domain on the onion arm, which
  breaks the callback leg.
- The clearnet CSP batch carries --clearnet-timeout again; their batch dict
  hardcoded zero while the role still passes the flag.
- The dashboard keeps its i18n content dir, image, version and design
  resolution; their side reduced the logo sources to the bare service
  provider values.

Their side wins where it is measurably better: the onion mirror rewrite is
gated per vhost rather than per app, the Playwright onion decision reads the
pass's own domain instead of the role's canonical one, and the matomo
reinjection and dashboard config render per network sibling.

Eight files were broken by the merge without ever carrying a conflict marker,
because git marks only the lines both sides touched:

- utils/cache/domains.py lost the onionize block that sat between two hunks
- roles/sys-front-inj-all/templates/body_filter.lua.j2 called it
- web-app-bluesky, keycloak sso_proxy: the get_entity_name filter was renamed
- trigger/__main__.py, playwright_coverage.py and its test: the deleted tor
  module
- cli/administration/deploy/ci/timings.py read Label.tor
- plugins/filter/csp_filters.py called _aligned_url with four of six arguments
- tests/unit/python/utils/cache/test_domains.py referenced a renamed class
- tests/.../sys-ctl-hlth-csp/files/test_script.py mocked a function main no
  longer calls

Verified: the variant layer (155 tests, 65 subtests), ca_injected (18),
the CI layer (175), the domains cache including the restored guard (32),
retrigger inputs (9), timings and the CSP health script (53). make
quality-high clears autoformat; its remaining findings are tracked separately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-23 09:53:41 +02:00

176 lines
5.8 KiB
Python

"""Unit tests for roles/test-e2e-playwright/files/timeouts.js.
The helper is dependency-free plain CommonJS. We copy it into a temp dir
and call it from a short Node script with controlled env, then assert the
computed timeout / onion detection.
"""
import os
import shutil
import subprocess
import tempfile
import textwrap
import unittest
from pathlib import Path
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
HELPER_PATH = str(
PROJECT_ROOT / "roles" / "test-e2e-playwright" / "files" / "timeouts.js"
)
DOMAIN = default_domain_primary()
def _have_node():
return shutil.which("node") is not None
@unittest.skipUnless(_have_node(), "node is not available in PATH")
class TestTimeoutsHelper(unittest.TestCase):
def setUp(self):
self.tmpdir = tempfile.mkdtemp(prefix="timeouts-helper-")
shutil.copy(HELPER_PATH, str(Path(self.tmpdir) / "timeouts.js"))
def tearDown(self):
shutil.rmtree(self.tmpdir, ignore_errors=True)
def _run(self, expr, env):
script = textwrap.dedent(
f"""
const t = require("./timeouts");
process.stdout.write("RESULT:" + JSON.stringify({expr}) + "\\n");
"""
)
script_path = str(Path(self.tmpdir) / "run.js")
with Path(script_path).open("w") as f:
f.write(script)
proc = subprocess.run(
["node", "run.js"],
capture_output=True,
text=True,
env={**os.environ, **env},
cwd=self.tmpdir,
timeout=10,
check=False,
)
self.assertEqual(
proc.returncode, 0, msg=f"stderr={proc.stderr}\nstdout={proc.stdout}"
)
return proc.stdout
def test_clearnet_default_factor_is_identity(self):
out = self._run(
"t.resolveTimeout(60000)",
{"CANONICAL_DOMAIN": f'"x.{DOMAIN}"'},
)
self.assertIn("RESULT:60000", out)
def test_onion_applies_default_multiplier(self):
out = self._run(
"t.resolveTimeout(60000)",
{"CANONICAL_DOMAIN": '"x.abc123.onion"'},
)
self.assertIn("RESULT:300000", out)
def test_global_factor_scales_clearnet(self):
out = self._run(
"t.resolveTimeout(60000)",
{
"CANONICAL_DOMAIN": f"x.{DOMAIN}",
"PLAYWRIGHT_TIMEOUT_FACTOR": "2",
},
)
self.assertIn("RESULT:120000", out)
def test_factor_and_onion_multiplier_compose(self):
out = self._run(
"t.resolveTimeout(60000)",
{
"CANONICAL_DOMAIN": '"x.abc123.onion"',
"PLAYWRIGHT_TIMEOUT_FACTOR": "2",
"PLAYWRIGHT_ONION_TIMEOUT_MULTIPLIER": "3",
},
)
self.assertIn("RESULT:360000", out)
def test_invalid_factor_falls_back_to_one(self):
out = self._run(
"t.resolveTimeout(60000)",
{
"CANONICAL_DOMAIN": f"x.{DOMAIN}",
"PLAYWRIGHT_TIMEOUT_FACTOR": "0",
},
)
self.assertIn("RESULT:60000", out)
def test_a_waiter_may_not_outlive_the_suite_that_contains_it(self):
"""The onion run that starved web-app-docs: base 2_700_000 at
multiplier 2 asked for 5_400_000 against a 5_340_000 suite budget, so
the global timeout fired first and every remaining spec was reported
"did not run" without naming the waiter."""
out = self._run(
"t.resolveTimeout(2700000) + ':' + t.SUITE_RESERVE_MS",
{
"CANONICAL_DOMAIN": '"docs.abc123.onion"',
"PLAYWRIGHT_TIMEOUT_FACTOR": "1",
"PLAYWRIGHT_ONION_TIMEOUT_MULTIPLIER": "2",
"INFINITO_PLAYWRIGHT_GLOBAL_TIMEOUT_MS": "5340000", # nocheck: the playwright role passes this into the sidecar container, it is not a .env key
},
)
capped, reserve = out.split("RESULT:")[1].strip().strip('"').split(":")
self.assertEqual(int(capped), 5340000 - int(reserve))
def test_a_timeout_inside_the_budget_is_left_alone(self):
out = self._run(
"t.resolveTimeout(30000)",
{
"CANONICAL_DOMAIN": '"docs.abc123.onion"',
"PLAYWRIGHT_ONION_TIMEOUT_MULTIPLIER": "2",
"INFINITO_PLAYWRIGHT_GLOBAL_TIMEOUT_MS": "5340000", # nocheck: the playwright role passes this into the sidecar container, it is not a .env key
},
)
self.assertIn("RESULT:60000", out)
def test_without_a_declared_budget_nothing_is_capped(self):
out = self._run(
"t.resolveTimeout(5400000)",
{"CANONICAL_DOMAIN": '"x.infinito.test"'},
)
self.assertIn("RESULT:5400000", out)
def test_is_onion_target_detects_quoted_and_bare(self):
self.assertIn(
"RESULT:true",
self._run("t.isOnionTarget()", {"CANONICAL_DOMAIN": '"x.abc.onion"'}),
)
self.assertIn(
"RESULT:true",
self._run("t.isOnionTarget()", {"CANONICAL_DOMAIN": "x.abc.onion"}),
)
self.assertIn(
"RESULT:false",
self._run("t.isOnionTarget()", {"CANONICAL_DOMAIN": f'"x.{DOMAIN}"'}),
)
def test_is_onion_target_reads_app_base_url_first(self):
self.assertIn(
"RESULT:true",
self._run("t.isOnionTarget()", {"APP_BASE_URL": '"https://x.abc.onion/"'}),
)
self.assertIn(
"RESULT:false",
self._run(
"t.isOnionTarget()",
{
"APP_BASE_URL": f'"https://x.{DOMAIN}/"',
"CANONICAL_DOMAIN": '"x.abc.onion"',
},
),
)
if __name__ == "__main__":
unittest.main()